EUVD-2026-56857
GHSA-pw82-xvrp-3rqp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the non-default 'Send website emails with AcyMailing' configuration required beyond the attacker's control; PR:L for mandatory subscriber account; full C/I/A:H for resulting admin account takeover.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails - including those targeting administrator accounts - to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.
Articles & Coverage 1
AnalysisAI
AcyMailing WordPress plugin (all versions through 10.11.1) allows authenticated attackers with subscriber-level access to exploit an authorization bypass and silently overwrite the BCC field of the plugin's core notification template, redirecting all subsequent WordPress password-reset emails - including those for administrator accounts - to an attacker-controlled address. By then triggering the standard WordPress lost-password flow for any account, the attacker intercepts the one-time reset token and achieves full site administrator compromise without any victim interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions simultaneously: (1) AcyMailing plugin version 0 through 10.11.1 must be installed and active on the WordPress site; (2) a site administrator must have explicitly toggled on the 'Send website emails with AcyMailing' setting in AcyMailing's configuration - this is a non-default option that routes WordPress core transactional emails, including password resets, through AcyMailing's templating engine instead of the WordPress default mailer; and (3) the attacker must hold at minimum a WordPress subscriber-level account on the target site, obtainable via self-registration on sites where user registration is open. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scoring 8.8 is broadly directionally correct - the attack is network-accessible, requires only low-privilege authentication, and the outcome is full administrator account compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker self-registers a free subscriber account on a WordPress site running AcyMailing ≤10.11.1 with 'Send website emails with AcyMailing' enabled, then exploits the authorization bypass to overwrite the BCC field of the acy_notification_cms template with their own email address. The attacker subsequently initiates the publicly accessible WordPress lost-password flow targeting the site administrator's username or email, causing the generated one-time reset link to be silently forwarded to the attacker; using that link, the attacker sets a new admin password and achieves full site control. … |
| Remediation | Update AcyMailing to a version above 10.11.1 as the primary remediation; an upstream code change is confirmed by WordPress plugin repository changeset 3632690 at https://plugins.trac.wordpress.org/changeset/3632690/acymailing, though the exact released plugin version containing this fix is not explicitly stated in available data - verify the current version in the WordPress plugin directory before assuming safety. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations running AcyMailing and document subscriber account access levels and notification template configurations to identify exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Acymailing An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress
View allAuthenticated privilege escalation in the AcyMailing WordPress plugin (versions up to and including 10.8.2) allows users
Stored Cross-Site Scripting in the AcyMailing WordPress newsletter plugin (all versions up to and including 10.10.2) per
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today